Static task
static1
Behavioral task
behavioral1
Sample
8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861.dll
Resource
win10v2004-20231215-en
General
-
Target
8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861
-
Size
3.5MB
-
MD5
61adfb0f8ba15fc792695830c598069e
-
SHA1
5810d2b5ca53f18d710a9ac636153481f5e99934
-
SHA256
8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861
-
SHA512
c6094c0ce4ab91c06458edc61a6e4652f3796f5706d2dd4af34223334107a7574e72961e48bf4d952a257b28ed0541d77f1486ffdc6d937260741228b145681e
-
SSDEEP
49152:IGtlqShVwASOynIU6i7ekwskgHOlg+wD0G7PTeBruS6EgqB/7iWEuPpXmNnZdP+X:EI++8HOihyN7EuSZ4A+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861
Files
-
8c3800d72a1347eb39e2e4d8728b506e212598143c5b2c25a21a99acfe346861.dll windows:6 windows x64 arch:x64
862cf183cdea8698793306da66776c9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
rpcrt4
RpcAsyncInitializeHandle
NdrAsyncClientCall
RpcBindingFromStringBindingW
RpcAsyncCompleteCall
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree
RpcStringBindingComposeW
advapi32
CryptSetHashParam
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptAcquireContextW
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
ws2_32
recv
WSAGetLastError
send
WSASetLastError
WSACleanup
closesocket
crypt32
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
kernel32
LCMapStringEx
CompareStringEx
DecodePointer
InitializeCriticalSectionEx
GetLocaleInfoEx
IsProcessorFeaturePresent
ReadFile
InitializeSRWLock
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
CreateThread
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
SleepEx
GetFileAttributesW
GetFileInformationByHandle
GetCurrentThread
ReleaseSRWLockShared
GlobalLock
AcquireSRWLockShared
VerSetConditionMask
VerifyVersionInfoW
GlobalUnlock
GetCommandLineW
GetModuleFileNameW
CreateEventW
SetEvent
TlsAlloc
LoadLibraryW
GetWindowsDirectoryW
TlsFree
HeapFree
HeapAlloc
GetProcessHeap
SetFileInformationByHandle
GetFileSize
CreateFileMappingW
VirtualQueryEx
VirtualFree
VirtualAlloc
FreeLibrary
WaitForMultipleObjects
CreateDirectoryW
TlsSetValue
SetLastError
WriteFile
MultiByteToWideChar
GetTickCount64
GlobalAlloc
GlobalFree
TlsGetValue
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
WideCharToMultiByte
GetFileInformationByHandleEx
UnmapViewOfFile
DuplicateHandle
GlobalSize
GlobalFlags
QueryDosDeviceW
CompareStringW
lstrlenW
SetFilePointer
OpenProcess
GetLogicalDriveStringsW
QueryFullProcessImageNameW
VirtualProtect
GetCurrentProcess
SuspendThread
ResumeThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
LoadLibraryExA
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
HeapSize
GetModuleHandleExW
FlushFileBuffers
MapViewOfFile
FormatMessageA
GetSystemTime
SystemTimeToFileTime
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapValidate
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
TryEnterCriticalSection
DeleteCriticalSection
VirtualLock
VirtualUnlock
MoveFileExW
GetStdHandle
GetEnvironmentVariableW
GetFileType
DeleteFiber
ConvertFiberToThread
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
ExitProcess
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetCurrentDirectoryW
GetStringTypeW
bcrypt
BCryptGenRandom
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 623KB - Virtual size: 623KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ